environment hooks に置いた門番の実測 — 判定は46マイクロ秒、起動は23ミリ秒

import os, re, shlex
 
READ_ONLY = {
    "ls","cat","head","tail","wc","grep","stat","file","du","df",
    "python3","python","node","npm","pytest","echo","printf","jq",
    "sed","awk","sort","uniq","diff",
}
GIT_READ_ONLY = {"status","log","diff","show","branch","rev-parse","ls-files","describe","blame"}
DESTRUCTIVE_BIN = {"rm","mkfs","mkfs.ext4","dd","truncate","shred","mv","chmod","chown"}
WRAPPERS = {"env","sudo","nohup","time","xargs"}
SHELLS = {"sh","bash","zsh"}
 
def _split_segments(cmd: str):
    """&& || ; | で区切り、各セグメントを argv 化する。解析不能なら None"""
    segs, buf, i, quote = [], "", 0, None
    while i < len(cmd):
        c = cmd[i]
        if quote:
            buf += c
            if c == quote:
                quote = None
            i += 1
            continue
        if c in "\"'":
            quote = c; buf += c; i += 1; continue
        if cmd.startswith("&&", i) or cmd.startswith("||", i):
            segs.append(buf); buf = ""; i += 2; continue
        if c in ";|":
            segs.append(buf); buf = ""; i += 1; continue
        buf += c; i += 1
    segs.append(buf)
 
    out = []
    for s in segs:
        s = s.strip()
        if not s:
            continue
        try:
            argv = shlex.split(s)
        except ValueError:
            return None  # 引用符が閉じていない等。安全側に倒す
        if argv:
            out.append(argv)
    return out
 
 
def guard_allowlist(cmd: str, depth: int = 0) -> bool:
    """True を返したら拒否。深さ制限つきで sh -c の中身も再帰的に見る"""
    if depth > 3:
        return True
    segments = _split_segments(cmd)
    if segments is None:
        return True
 
    for argv in segments:
        head = os.path.basename(argv[0])   # /bin/rm → rm
        args = argv[1:]
 
        # env / sudo などのラッパを剥がす
        while head in WRAPPERS and args:
            head = os.path.basename(args[0]); args = args[1:]
 
        # sh -c '...' は中身を再帰検査
        if head in SHELLS:
            inner = next((a for a in args if not a.startswith("-")), None)
            if inner is None or guard_allowlist(inner, depth + 1):
                return True
            continue
 
        if head in DESTRUCTIVE_BIN:
            return True
        if head == "find":            # -delete / -exec を持ちうる
            return True
        if head == "git":
            sub = next((a for a in args if not a.startswith("-")), None)
            if sub not in GIT_READ_ONLY:
                return True
            continue
        if head not in READ_ONLY:     # 知らないコマンドは通さない
            return True
 
    # `: > file` のような、コマンドを持たない上書きリダイレクト
    if re.search(r"(^|[^>\w])>\s*\S", cmd) and not re.search(r">>\s*\S", cmd):
        return True
    return False

WRITABLE_PREFIXES = ("/workspace/out/", "/workspace/NOTES.md", "/tmp/")
 
def _redirect_targets(cmd: str):
    return re.findall(r">>?\s*([^\s;|&]+)", cmd)
 
def guard_scoped(cmd: str) -> bool:
    targets = _redirect_targets(cmd)
    if not targets:
        return guard_allowlist(cmd)
    for t in targets:
        if not t.strip("\"'").startswith(WRITABLE_PREFIXES):
            return True
    # 書き込み先が全て許可スコープ内なら、リダイレクトを外した本体だけ再検査
    body = re.sub(r">>?\s*[^\s;|&]+", "", cmd)
    return guard_allowlist(body)

#!/usr/bin/env python3
# hook_pre_tool.py — ツール呼び出し前に走るガード
import sys, json
from guards import guard_scoped
 
def main() -> int:
    payload = json.load(sys.stdin)
    if payload.get("tool") != "shell":
        return 0                       # シェル以外は素通し
    cmd = payload.get("input", {}).get("command", "")
    if guard_scoped(cmd):
        print(json.dumps({
            "decision": "deny",
            "reason": "書き込み許可スコープ外、または読み取り専用 allowlist にないコマンドです",
        }))
        return 1
    print(json.dumps({"decision": "allow"}))
    return 0
 
if __name__ == "__main__":
    sys.exit(main())

$ echo '{"tool":"shell","input":{"command":"rm -rf /workspace"}}' | python3 hook_pre_tool.py
{"decision": "deny", "reason": "書き込み許可スコープ外、または読み取り専用 allowlist にないコマンドです"}
$ echo $?
1
 
$ echo '{"tool":"shell","input":{"command":"git log --oneline -5"}}' | python3 hook_pre_tool.py
{"decision": "allow"}
$ echo $?
0